Single service comparison

Cloud Armor is a single policy plane bound to Google's external load balancers, where WAF, IP allow/deny, rate limiting, and DDoS scrubbing are expressed as ordered rules inside one security policy. Huawei splits these concerns across services: WAF handles L7 HTTP/HTTPS inspection as a reverse-proxy style service fronting protected origin servers, while Anti-DDoS Service (AAD) handles volumetric L3/L4 and L7 DDoS through high-defense IPs and scrubbing centers. CFW can add east-west and VPC-boundary filtering. Architects must model policy scope, attachment points, and rule evaluation order separately per Huawei service rather than one unified policy object.

Cloud Armor integrates natively with Google Cloud Load Balancing, CDN, and Cloud Logging/Monitoring, with rules referencing backend services, CEL expressions, and named IP ranges. Huawei WAF integrates with ELB and custom origin servers and exports events to Log Tank Service (LTS); AAD provides its own high-defense IP forwarding and protection telemetry. Scaling and HA differ: Cloud Armor inherits Google's anycast global edge, while Huawei WAF is regional with intra-/cross-AZ and cross-region DR and edition-based QPS limits, and AAD relies on distributed scrubbing centers. Operational responsibility is split between WAF and AAD consoles on Huawei, versus one Cloud Armor console on GCP.

Start with an inventory of existing Cloud Armor security policies: per-policy rule lists, match predicates (IP/ASN/geo, CEL expressions, request headers/paths), actions (allow/deny/rate-ban/throttle/redirect), and their bound backend services. Classify each policy into L7 WAF intent versus L3/L4 DDoS intent. Select Huawei targets accordingly: WAF for HTTP/HTTPS inspection, OWASP coverage, CC protection, and geo/crawler rules; AAD for volumetric scrubbing and high-defense IP hosting; CFW only where VPC-edge or east-west filtering is also required. Avoid assuming one-to-one rule translation, as match semantics and rule precedence differ between Cloud Armor's ordered rules and Huawei's per-service rule models.

Migrate configuration by reconstructing policies in Huawei WAF first: add protected domains, set origin server addresses, then rebuild access control, CC, tamper, and reference rule sets using WAF's rule types. Translate Cloud Armor IP allow/deny and geo restrictions into WAF geolocation/blacklist rules where the edition supports them, confirming which features require Professional or Platinum. For DDoS, point public DNS to AAD high-defense IPs (or protected EIPs) and configure AAD traffic policies, scrubing thresholds, and CC/WAF sub-policies. Reissue certificates via CCM where WAF terminates TLS, and wire WAF/AAD event alarms into Cloud Eye and LTS to mirror Cloud Armor alerting.

Validate before cutover with shadow or low-weight traffic: replay representative request samples through Huawei WAF to compare detection/block decisions against Cloud Armor logs, check false positives and bypass paths, and confirm origin reachability and TLS handshake behavior. Run controlled load tests against AAD-protected IPs to verify scrubbing thresholds and latency, and verify rule precedence produces the intended allow/deny ordering. Schedule cutover during a low-traffic window by flipping DNS to the Huawei-protected endpoints, monitor initial traffic, and keep Cloud Armor policies enabled as a fallback until traffic and error rates stabilize.

Mind the pricing and quota model change. Cloud Armor typically bills per policy, per rule, and per million evaluated requests plus network egress, whereas Huawei WAF bills by edition with included QPS, domain, and feature tiers, and AAD bills by protected IP, protection package, and traffic. Recalculate TCO using peak QPS, request volume, domain count, geographic features, and cross-region traffic. Confirm regional availability of WAF (25 regions stated) and AAD scrubbing, and note that some Cloud Armor features such as CEL-based custom rules and bot-management reCAPTCHA integration have no direct Huawei equivalent and may require compensating controls.